How your data is protected
Vial Workspace runs on your own computer or your own NAS. Your orders, customers and stock records stay with you and are never sent to us.
Where your data lives
Everything is kept in one database file in the program's data folder, along with the COAs, receipts and packing photos you add. You can copy, back up or move that folder whenever you like.
The app connects to the internet only when you ask it to:
- Sending an email from your own email account, if you set that up.
- Fetching a COA from a lab link you paste in.
- Checking for a program update. You press Check now, or tick a daily check, and nothing about your business is sent.
- Talking to your WooCommerce store, if you connect one with Pro.
- Letting your phones and other computers reach it, if you switch that on.
If you use our data migration service, the files you choose to send us are used only for that job, and we delete all of them when it is done.
Who can get in
- Sign-in. Each person has their own username and password. Passwords are stored as salted scrypt hashes, never as readable text.
- 2-step sign-in. After the password, a person types a 6-digit code from an authenticator app on their phone. It is switched on by each person for their own account, works without internet, and is included on every license. Each person also gets 10 single-use backup codes, shown once. Five wrong codes pause sign-in for 10 minutes, and an owner can reset 2-step sign-in for someone who has lost their phone and codes.
- Protection against guessing. After several wrong passwords the account pauses, and repeated attempts from one network are slowed down.
- Sessions end. On a shared computer, sign-in ends after an hour without use. Changing a password signs that person out everywhere else.
- Roles. Owner, Manager, Order entry, Shipping and Read-only each see only what their job needs. Every page and every save is checked against the person's role on the server.
- Phones and other PCs can connect only once sign-in is switched on. Access from outside your home or office goes through an encrypted HTTPS connection.
Shipping users never see costs or profit. Owners decide whether Order entry and Read-only accounts can. Managers run operations and reports without access to users or settings. Compare the five roles.
Keeping a record
- The audit log shows every change made in the app, who made it and when.
- Every change to money (prices, discounts, payments, refunds and costs) is kept with the old value, the new value and who made it.
- Uploaded files are checked for type and size, and each is fingerprinted so tampering can be spotted.
Backups
The app takes a snapshot every time it starts and once a day, and can copy a full backup to a folder you choose, such as a USB drive or a cloud-synced folder. Before an import or a restore it saves a snapshot first, so you can go back.
Lock your backups with a password. The owner can set a backup password. After that, every full backup, including the automatic daily ones and the ones you download, is saved as an encrypted .vwbackup file.
- Backups are encrypted with AES-256-GCM. The key comes from your password through scrypt, so a guess has to be worked out slowly.
- The app keeps only the public half of a key pair. That is enough to lock new backups and never enough to open one, so a copy of the database alone cannot unlock them.
- Each backup has its own random key. A changed byte, a missing piece or a cut-off file is caught instead of being quietly restored.
- Automatic backups keep working with nobody there. Opening one needs the password typed in, which gives you the plain .zip back.
- Changing the password only affects new backups. Older ones keep the password they were made with.
If the backup password is lost, nobody can open those backups, including us. Write it down and keep it away from the computer. The snapshots kept on the PC itself, and the database file, are not locked by the app: turn on your computer's disk encryption (BitLocker on Windows) or your NAS's encrypted folder, and keep backup drives somewhere safe.
Built-in web protections
The app's pages refuse to be embedded in other sites, check a secret token on every save to block forged form submissions, run only the app's own scripts, and ask search engines not to index them. On a server, the sign-in cookie only travels over HTTPS. Your email account password is stored encrypted with your Windows account's own key, so a copy of the file on another PC cannot read it.
Program updates
Updates are checked for a valid signature before they are installed, and only updates signed by us are accepted. Before installing, the app takes a backup. Your data folder is never touched, and you can go back to the previous version for 30 days.
Your customers' personal details
Card numbers are never stored: payments record the method, amount, reference and proof only. If a customer asks what you keep about them, one button downloads everything about them as a spreadsheet and files. If they ask to be deleted, another removes their name, email, phone, address, notes and messaging handles, while keeping their orders, payments and state so your books and sales-tax records stay right. A backup is taken first.
When you ask us for help
The support bundle in Settings → License holds the version, license, computer details, a database health check and the end of the log. It contains no orders, customers, prices or passwords, and email addresses and phone numbers in the log are blanked out. You can read every word of it before you send it.
What you should do
- Use a strong, unique password for each person, and switch on 2-step sign-in.
- Set a backup password, write it down, and keep one locked copy off site.
- Turn on disk encryption on the computer or NAS that holds Vial Workspace.
- Give staff the narrowest role that fits their job.
Vial Workspace is business software for record keeping. You remain responsible for how you collect and use your customers' information, including any privacy laws that apply to you.